From 47628cc5f26e8a88397efac59cdc82792eb502d4 Mon Sep 17 00:00:00 2001 From: Sirius DevOps Date: Thu, 27 Aug 2026 18:26:57 -0400 Subject: [PATCH] ci: pin db image instead of rebuilding in CI Dockerfile.pg installs TimescaleDB from packagecloud.io, which the Pi's network cannot reach (ISP abuse-mitigation blackholes AWS ranges after the masscan incident). Every CI deploy rebuilt the DB image and failed on the packagecloud fetch, blocking all pipelines. The DB image is now built once manually (docker compose build db) and pinned as localhost/osint-dashboard-pg:latest; compose up uses it directly. The app build only needs deb.debian.org + pypi + the docker daemon's registry mirror, all reachable. --- docker-compose.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 4d83854..bb12741 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -14,10 +14,13 @@ name: osint-dashboard services: db: - build: - context: . - dockerfile: Dockerfile.pg - platforms: ["linux/arm64"] + # NO build: block here on purpose. The DB image (TimescaleDB+PostGIS) is + # built once via Dockerfile.pg and pinned as localhost/osint-dashboard-pg. + # Dockerfile.pg installs TimescaleDB from packagecloud.io, which some + # networks (and ISP abuse-mitigation blackholes) block, so rebuilding it + # on every CI deploy made the pipeline flaky. Rebuild manually when the + # base image or extensions need bumping: + # docker compose build db && docker compose up -d db image: localhost/osint-dashboard-pg:latest container_name: osint-db restart: unless-stopped